Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
RACI and Escalation
RACI for risk activities
The four letters
| Letter | Meaning |
|---|---|
| R | Responsible: does the work |
| A | Accountable: answers for the result (exactly one person) |
| C | Consulted: gives input beforehand |
| I | Informed: told afterwards |
Escalation paths
Escalation should be triggered by thresholds agreed in advance, so it isn’t a personal fight. It’s part of normal governance, not a sign of failure.
Example. A KRI for unpatched critical servers turns red. The agreed path sends it to the risk owner the same day and to the steering committee if it isn’t recovered in 30 days. When it wasn’t, the committee approved an emergency patch window.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| How many Accountable per activity | Exactly one |
| Purpose of a RACI | Clarify roles and avoid gaps or overlaps |
| What triggers escalation | Agreed thresholds |
| Owner ignores an overdue high risk | Escalate through the agreed path |
In short
- RACI shows who is Responsible, Accountable, Consulted and Informed for each activity.
- Each activity has exactly one Accountable person.
- Escalation paths define how far a risk travels based on agreed thresholds.
- Escalation should be triggered by thresholds agreed in advance, not personal judgement alone.
- Escalation is part of normal governance, not a sign of failure.
Exam traps
- Two Accountable people for one activity.
- Escalating directly to the board, skipping the risk owner.
- Not escalating because it might upset the owner.
- Escalation paths with no thresholds.
Slides
Click the slide and use the arrow keys. F toggles full screen.
RACI for risk activities
Escalation paths
ExampleA KRI for unpatched critical servers turns red. The agreed path sends it to the risk owner the same day and to the steering committee if not recovered in 30 days. When it wasn't, the committee approved an emergency patch window.
1 / 7